Security · Zero Trust & Secure Architecture · 03
Privileged access management
Privileged access management brings administrative accounts, service accounts and other high-privilege credentials under control: who has them, why, how they are used, how use is recorded and how privilege is removed when it is no longer needed. It is needed when administrators use their daily accounts for privileged work, when service accounts have passwords that never change and nobody knows, when an audit or insurer asks how privileged access is governed, or when an incident showed that one credential reached everything. The work produces an inventory of privileged accounts and credentials with owners, a tiered administrative model that separates daily use from privileged use, controls for just-in-time and recorded access where warranted, and the review cycle that keeps privilege from growing back.
Scope
What the review covers.
- Privileged account and credential inventory across directories, cloud, network and applications
- Administrative tiering and separation of daily and privileged accounts
- Service account governance: ownership, rotation, least privilege
- Just-in-time elevation and session recording where justified
- Vault or privileged access tooling requirements, where needed
- Review cycle and evidence
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Privileged inventory | Accounts, credentials, owners, justification |
| Administrative model | Tiering, separation and elevation rules |
| Service account plan | Ownership, rotation and least privilege |
| Review procedure | Cadence and records for audits |
Prerequisites
What we need from you.
- Administrative access to directories and cloud identity, or sessions with their owners
- Knowledge of automation and integrations that use service accounts
- A decision on whether privileged access tooling is in or out of scope
Related
Where this sits.
- Zero Trust & Secure Architecture Service
- Security Hub
- Network segmentation Also
- Secure remote access Also
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Do we need a privileged access product?
Not always. The inventory and the administrative model come first; tooling follows when the number of privileged paths justifies it.
How do you handle service accounts nobody can identify?
They are inventoried, their use is traced through logs, and a decision is recorded: own it, rotate it or retire it.
Will this slow down administrators?
Separation and elevation add seconds, not hours, when designed well. The model is built with the administrators who will live in it.